A one-day audit of ad traffic: a step-by-step checklist
Contents
Share
A one-day audit of ad traffic is a check of the Direct source, the Direct report group, and a single day broken down by minute when Webvisor looks suspicious, plus a decision on that day’s placements. Direct’s help is what recommends this look at a suspicious Webvisor. The signs of click fraud stay a separate list: the day exists so you do not argue from a monthly chart.
Below is an order for one calendar day. Figures in the example are labeled as a teaching example: the help does not say how many clicks are already “statistically significant.”
How to start the morning
Take one counter and one calendar day. Do not mix yesterday and today: a visit and a placement are tied to a time, and later you will not remember which hour you opened.
If Webvisor looks suspicious, Direct’s help recommends three actions, in order:
The source is Direct, not the whole site.
Compare that source with the reports in the Direct group.
Look at the day with a breakdown by minute.
Minutes matter because a burst in one hour looks like an ordinary day in the daily total. You are looking for a stretch where clicks arrive in a pack, not for an “average CTR.” How bots show up in Webvisor and bots in Metrica is covered in those articles. This one only sets the frame of the day, so those signs are not retold.
What counts as a visit on this day
A visit in Metrica is a sequence of actions by one visitor on one counter. The sequence includes pageviews, outbound clicks, file downloads, and calls to reachGoal, hit, params, extLink, file, and notBounce. The visit ends when there is no activity. The default timeout is 30 minutes.
The first click from an ad system, for example from Direct, is always its own visit. While that visit is open, further clicks on the ad do not become new visits.
Three checks follow from that, with no new thresholds:
Two clicks on an ad inside one half-hour can be one visit if the first already opened a visit from Direct. “More clicks than visits” in that half-hour does not yet prove extra people.
After 30 minutes with no activity, the next arrival is a new visit, even for the same person. A day broken down by minute shows whether there was a gap.
A goal, an outbound click, and a file download belong to the same visit until the timeout. Clicks without leads come after you know in which visit a goal could have fired at all.
A teaching example. Suppose a click from Direct at 10:01, another click on the same ad at 10:20, and another at 11:05. The first two actions can sit in one visit: the repeat did not become a new visit while the first was still open. The third, after a gap of more than 30 minutes, is a separate visit if there was no activity between 10:20 and 11:05. That is the arithmetic of the rule, not a measurement of your campaign.
Placements: a block from the report, not from memory
In the Placements report you can allow or block impressions on a placement without leaving the report. A placement that is already blocked is marked grey. The help recommends deciding on statistically significant data and suggests turning previously disabled placements back on to recheck them. In one report you can change impressions for several campaigns at once. The same control exists in the Report wizard, grouped by placement name.
The help does not translate “statistically significant” into a number of clicks or conversions. In a day you can see a placement with a pack of clicks and zero goals and still not be entitled to call that significant only because the day ended. Suspicious YAN placements are covered separately. The rule for the day: do not block, from one screen, something you are not ready to enable again later and recheck.
A grey label means the block is already in place. Blocking it again changes nothing. If a placement is grey and absent from today’s slice, that is not “the attack got through”: impressions to it are already off.
Several campaigns in one report save the morning and create a mistake: the block applies to the campaigns you selected. Read the list before you confirm. The Report wizard grouped by placement name does the same control when you are not in the library report but in your own.
Checklist for one day
Mark these in order. A step with no answer means the day is not closed.
The slice source is Direct.
The slice was compared with the Direct report group, not only with the site-wide counter.
The suspicious stretch is open by minute inside the day, not “for the month.”
For a pack of clicks you checked whether they sit in one visit: the first ad click is always its own visit, a repeat inside it does not become a new visit, and the default timeout is 30 minutes.
Goals and file downloads are assigned to the visit in which they happened before the timeout.
Grey rows in Placements were not treated as a new find.
A block or a return of a placement was made from the report, on data you are ready to recheck later by turning it back on.
If several campaigns are affected, the campaign list was read before confirm.
The same action was repeated in the Report wizard by placement name if you work from there.
What the day does not prove: that a placement is “significant” in the help’s sense, that a gap between clicks and visits is extra people, that Yandex will refund the budget. The day prepares the facts for those conversations and does not replace them.
The manual limit: in a day you can open the minutes and a handful of placements. The network’s placement stream cannot be reread by hand every hour, and the rule “turn it back on and recheck” requires you to come back, or the grey list only grows. Binetro on the site separates a suspicious visit from a decision in the Direct account: the ad platform charges the click, and the service does not guarantee a refund.
Walk the same day through a teaching hour so the checklist does not stay a list of headings. Suppose the Direct source from 14:00 to 14:10 shows 40 clicks and 6 visits. The help does not ask you to call that bots. It asks for minutes and a comparison with the Direct report group. Open those ten minutes. The first click from Direct in each pair is its own visit. Further clicks on the ad, while the visit is open, do not become new visits. The default timeout is 30 minutes, so a pack inside ten minutes can compress into fewer visits with no data lost. Goals, file downloads, and outbound clicks, if they happened, sit in the same visit for as long as there was activity. The example is a teaching one: 40 and 6 are not a norm.
Then the placement the pack came from. In the Placements report a row is either ordinary or grey. Grey is already blocked, and blocking it again changes nothing. An ordinary row you can block without leaving the report, and in the same gesture for several campaigns at once. Read the campaign list before you confirm. The help recommends relying on statistically significant data and later turning the placement back on to recheck it. The count at which the data count as significant is not named, so “40 clicks in ten minutes” does not by itself justify a block. If you are not in the library report but in your own, the same control exists in the Report wizard grouped by placement name.
Close the day with three notes. The first: the source was Direct, and the minutes were opened. The second: for the pack, how many visits are explained by the rule “the first click is its own visit, a repeat inside it does not become a new one.” The third: for each placement you touched, whether it was already grey or you turned it off, and when you will turn it on again. Without the third note the grey list only grows, and the recheck the help asks for never starts.
If the day is short, do not stretch it into a month. The minutes of the suspicious stretch, the Direct source, and a comparison with the Direct report group are the whole frame the help gives for Webvisor. A visit with a 30-minute timeout explains why a pack has more clicks than visits, while repeat clicks do not open a new visit. A placement is explained by a grey label or by a new block from the report, with a promise to turn it on again. Anything beyond that — a bot share, a budget refund, “significance” in clicks — is not part of this day, because the day’s sources do not name it. Tomorrow starts from a clean slice, not from yesterday’s grey row treated as a new find.
Close the teaching hour 14:00–14:10, with 40 clicks and 6 visits, in one sentence: part of the gap can be the visit rule, and the rest is not interpreted without the minutes. Write the same kind of sentence for the placement: the help does not recommend a block with no plan to recheck. That is how the checklist stays a procedure rather than an impression of a chart.
Before you close the laptop, check three traps of the day. The first is looking at the site-wide counter instead of the Direct source and that group of reports. The second is counting every repeat click as a new visit, even though the first ad click already opened a visit and a repeat inside it does not become a new one until the 30-minute timeout. The third is blocking a grey placement again, or blocking an ordinary one with no intention of turning it on and rechecking. The Report wizard grouped by placement name falls into the same third trap if you confirmed several campaigns without looking.
Do not rewrite the teaching 40 clicks and 6 visits into a client report as a fraud share. They illustrate the visit rule. A statistically significant placement block is left by the help without a click count, so the day’s note holds an observation and a recheck date, not a verdict. Tomorrow’s slice starts clean: new minutes, the same source, grey rows as work already done, not as a new attack.